Apparatus and method for identifying related code variants in binaries

An apparatus comprising processing circuitry configured to execute instructions for:

• receiving query binary code;
• processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code;
• comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints;
• and
• preparing at least one report based on the similarity measure,
• wherein processing the query binary code comprises converting the query binary code into functional representation code, breaking the functional representation code into individual functional units, assigning a respective token to each corresponding unit portion of each respective one of the individual functional sections, and mapping each token to a character to define an ordered string of characters that form the compressed representation.